Splunk Search

How to add a comma separator to field numeric values using fieldformat command?

tmurray3
Path Finder

Have have a query that creates a timechart. I want to add a comma separator to the field numeric values. When I run the query it adds an extra field, plus the numeric values are not formatted.

Here is the query:

index=service_hourly_summary report="bystatus" earliest=-2w@w latest=@w|timechart span=1w sum(count) by status|rename _time as time |eval time=strftime(time,"%m/%d") | rename time as WeekOf|fieldformat status=tostring(status,"commas")| addtotals col=true row=false labelfield="Total Volume"| table WeekOf,*,"Total Volume"

       WeekOf FAILED SUCCESS  Total Volume   status
1      08/24   7577    66548
2      08/31   6882    58116
3              14459   24664  Total

Status has two values FAILED or SUCCESS, but I can't get the field formatted with commas. Also, is there a way to get rid of the Total Volume header, but keep the Total label in row 3?

Thanks in advance for your help!!

Tags (1)
1 Solution

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals

View solution in original post

kmattern
Builder

Use an eval statement to add commas.

| eval FAILED=tostring(FAILED, "commas")
| eval SUCCESS =tostring(SUCCESS, "commas")

Both row and column totals can be included in a search when outputting to a table. Either one or both can be used. To total rows use the addtotals function with a fieldname for the column total. In the example below the fieldname function is passed "Total" which is what appears at the top of the totals column. To add total columnms use the addcoltotals function. There is no corresponding row label that actually works. Note: The values being totalled must not have commas or any text data as part of the field.

| addtotals fieldname=Total 
| addcoltotals
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...